T01 · Skill Instruction Hijacking
Error
- Location
scripts/build_checkpoint.py:23- Finding
Untrusted checkpoint content can inject automatically dispatched resume instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Restart Task Recovery
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate restart-recovery purpose, but saved task text can become automatic resume messages sent to other sessions, so it needs review before use.
Review this skill before installing or using it in workspaces with sensitive tasks. Treat checkpoints as untrusted data, inspect generated recovery plans before sending them, avoid automatic sessions_send for free-form recovered messages, and store checkpoint/temp files in private locations with restrictive permissions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/smoke_test.sh:35- Finding
Predictable shared temporary files expose and permit tampering with recovery plans
- Content
View full analysis
/dev/null python3 "$ROOT/scripts/recover_from_latest_checkpoint.py" "$CP" > "$TMPDIR/recover-actions.json" python3 "$ROOT/scripts/pre_resume_verify.py" "$TMPDIR/recover-actions.json" "$TMPDIR/recover-verified.json" >/dev/null python3 "$ROOT/scripts/execute_verified_recovery.py" "$TMPDIR/recover-verified.json" > "$TMPDIR/recover-exec.json" ``` `scripts/smoke_test.sh:51-52`: ```bash p=os.environ.get('TMPDIR','/tmp') with open(f"{p}/recover-exec.json","r",encoding='utf-8') as f: ``` The documented workflow also uses fixed paths: ```bash python3 scripts/recover_from_latest_checkpoint.py > /tmp/recover-actions.json python3 scripts/pre_resume_verify.py /tmp/recover-actions.json /tmp/recover-verified.json python3 scripts/execute_verified_recovery.py /tmp/recover-verified.json > /tmp/recover-exec.json ``` ### Technical Analysis The workflow stores intermediate action plans at predictable names under `/tmp` or a caller-controlled `TMPDIR`. These files contain session identifiers and free-form resume instructions. Predictable shared filenames create several security problems: - Concurrent executions can overwrite or consume each other's files. - Another local process with sufficient access can replace a plan between generation and verification or execution. - File confidentiality depends on the process umask and temporary-directory permissions. - Shell redirection and ordinary file writes do not explicitly reject symbolic links. - No private temporary directory is created, and no cleanup handler removes sensitive artifacts. The final exploitability of symbolic-link attacks depends on operating-system protections and the ...[truncated 1364 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs use of file reads/writes and local script execution workflows but does not declare any explicit tool scope or allowed-tools boundary. That omission increases the chance the skill will run with broader-than-necessary capabilities, making misuse or accidental access to local files and environment data more likely in a restart/recovery context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script serializes stdin-provided session data directly into a persistent checkpoint file, and the fields included (goal, lastDone, nextStep, blockers, resume message) can easily contain sensitive task context, secrets, internal paths, or user data. In a restart-recovery skill, persisting in-progress multi-agent state is expected, but doing so without minimization, redaction, or an explicit warning increases the chance of unintended sensitive data retention on disk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
These lines invoke several subordinate scripts and include an 'execute_verified_recovery' step, which may perform consequential actions, but the shell file provides no comments or pre-execution notice describing that subprocess-driven recovery logic will run. The final summary output does not satisfy the requirement for advance disclosure of safety-relevant subprocess execution.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example note is written only in Chinese: “配置已更新并重启；将按 checkpoint 恢复中断任务。” This introduces a locale-specific instruction in the skill guidance without offering a language choice or explaining that the workflow is intended for a Chinese-only environment.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains user-facing template text in Chinese for status updates and manual confirmations. Because the file does not indicate that the skill is region-specific or that the user can choose the language, it may violate language/locale policy requirements.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script writes recovery state and generated artifacts into shared workspace and temporary locations such as "$WS/tmp", "$WS/memory/restart-checkpoints", and "$TMPDIR" without creating isolated, permission-restricted files. If those paths are writable or observable by other local users/processes, sensitive session state could be disclosed or files could be replaced via symlink or race attacks, causing checkpoint corruption or unsafe downstream processing.
- Content